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ABSTRACT 

A  significant  challenge  in  intelligence  analysis  involves  knowing  when  a  social  network  description  is 
'complete’,  i.e.,  when  sufficient  connections  have  been  found  to  render  the  network  complete.  In  this 
paper,  a  combination  of  methods  is  used  to  predict  covert  network  structures  for  specific  missions.  The 
intention  is  to  support  hypothesis-generation  in  the  Social  Network  Analysis  of  covert  organisations.  The 
project  employs  a  four  phase  approach  to  modelling  social  networks,  working  from  task  descriptions 
rather  than  from  contacts  between  individual:  phase  one  involves  the  collation  of  intelligence  covering 
types  of  mission,  in  terms  of  actors  and  goals;  phase  two  involves  the  building  of  task  models,  based  on 
Cognitive  Work  Analysis,  to  provide  both  a  process  model  of  the  operation  and  an  indication  of  the 
constraints  under  which  the  operation  will  be  performed;  phase  three  involves  the  generation  of  alternative 
networks  using  Genetic  Programming;  phase  four  involves  the  analysis  of  the  resulting  networks  using 
social  network  analysis.  Subsequent  analysis  explores  the  resilience  of  the  networks,  in  terms  of  their 
resistance  to  losses  of  agents  or  tasks.  The  project  demonstrates  that  it  is  possible  to  define  a  set  of 
structures  that  can  be  tackled  using  different  intervention  strategies,  demonstrates  how  patterns  of  social 
network  structures  can  be  predicted  on  the  basis  of  task  knowledge,  and  how  these  structures  can  be  used 
to  guide  the  gathering  of  intelligence  and  to  define  plausible  Covert  Networks. 


1.0  INTRODUCTION 

Social  network  analysis  is  often  problematic  because  one  cannot  always  guarantee  sufficient  data  to  know 
that  a  network  is  complete  [12.].  To  this  end,  constructing  networks  on  the  basis  of  observed 
communications  might  provide  partial  views  of  such  networks;  because  some  communications  might  not 
be  observed,  or  some  connections  might  lie  outside  the  normal  scope  of  intelligence  gathering,  or  some 
connections  might  represent  'noise’  (in  the  sense  that  they  are  part  of  the  network  but  not  suspicious). 
From  this,  we  argue  that  it  does  not  make  sense  to  speak  of  a  'complete’  network  (because  there  will 
always  be  the  possibility  of  more  connections  than  have  been  observed),  but  that  it  does  make  sense  to 
speak  of  a  'useful’  network.  A  useful  network  is  one  which  provides  details  of  the  associations  between 
key  actors  in  the  pursuit  of  a  particular  goal,  and  that  might  further  influence  intelligence  gathering 
activity. 
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strategy 


Figure  1:  Initial  Process  Model 

Figure  1  shows  the  process  model  followed  in  this  work.  We  assume  that  networks  are  built  and 
managed  in  pursuit  of  some  purpose,  and  that  functions  are  allocated  to  Actors  to  fulfil  this  purpose.  The 
strategy  provides  a  means  of  modifying  functions  in  the  light  of  constraints.  The  idea  of  building  network 
structures  from  task  models  has  been  previously  explored  by  [4.]  and  [1.].  However,  this  work  tends  to 
consider  single  networks  that  could  represent  the  task  model.  In  our  work,  we  are  concerned  with  the 
exploration  of  a  space  of  possible  networks. 

Early  studies  of  criminal  organisations  uncovered  business-like  ‘crime  families’  with  a  core  leadership 
involving  strong  family  ties  [5.].  However,  even  these  crime  families  exhibited  connections  across 
multiple  small  networks  often  specialising  on  specific  functions  or  relationships  [2.],  and  contemporary 
research  shows  there  appear  to  be  more  than  one  ‘network’  at  play  [17.]  [16.]  [19.]).  A  study  using 
‘wiretap’  conversations  of  drug  networks  identified  294  individuals  in  a  loose  social  network  with  very 
limited  connectivity,  i.e.,  very  few  individuals  contacted  more  than  2  people,  and  if  these  links  were 
removed,  the  network  would  be  able  to  maintain  its  existence  through  a  host  of  ‘weak-ties’  [15.].  We 
assume,  following  [8.],  that  covert  networks  are  not  necessarily  organisationally  different  from  overt 
networks,  i.e.,  a  drug  trafficking  network  will  exhibit  many  similarities  with  a  conventional  supply-chain. 
What  differentiates  the  covert  from  the  overt  network  is  the  level  of  risk  (personal,  financial  and 
operational)  involved  in  their  operations,  and  the  need  to  retain  an  air  of  secrecy.  This  need  for  secrecy, 
on  the  one,  provides  a  protection  for  core  members  of  the  network  and  for  the  network’s  assets,  but  could 
also  compromise  the  ability  to  share  information,  e.g.,  an  individual  in  the  network  might  not  have  a  clear 
view  of  all  preceding  and  succeeding  steps  in  the  process  (although  this  is  not  an  unusual  state  of  affairs  in 
the  overt  supply  chains).  We  assume  that  covert  networks  will  involve  short  communication  paths, 
typically  based  on  a  need-to-know  basis  and  related  to  the  process  of  tasks  being  followed.  The  approach 
involves  four  phases,  as  detailed  in  the  following  sections. 

Phase  One:  Compile  Intelligence:  We  assume  that  there  exists  a  set  of  intelligence  (either  gathered 
through  ongoing  operations,  or  held  as  experience  by  analysts).  Overall,  the  approach  follows  the  model 
proposed  by  [6.].  This  is  similar  to  [9.]  analysis  of  competing  hypotheses,  in  that  these  approaches  define 
Intelligence  Analysis  as  an  iterative  process  of  hypothesis  (or  assumption)  testing.  Figure  2  outlines  an 
approach  which  requires  the  Intelligence  Analyst  to  develop  intelligence  gathering  plans  on  the  basis  of 
plausible  events.  We  take  the  notion  of  plausible  events,  from  a  Human  Factors  perspective,  to  imply  the 
development  of  a  task  model,  and  the  process  of  assumption  testing  to  relate  to  the  problem  of  crew 
management,  i.e.,  how  does  a  ‘system’  assign  tasks  to  individuals  in  order  to  complete  a  mission,  and  how 
do  these  individuals  interact  during  the  course  of  the  mission? 
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Figure  2:  Assumptions-Based  Planning 

Phase  Two:  Build  Task  Model:  A  task  model  can  be  described  in  many  different  ways.  At  the  most 
basic,  it  would  simply  be  a  flowchart  showing  the  tasks  required  to  achieve  a  given  goal.  At  a  more 
detailed  level,  it  would  be  a  process  model  which  shows  the  relationship  and  dependencies  between  tasks 
in  pursuit  of  a  goal  and  some  of  the  contextual  factors  which  could  have  a  bearing  on  performance.  At  a 
still  more  detailed,  one  could  employ  Cognitive  Work  Analysis  to  define  the  relationship  between  task, 
context  and  constraint.  The  idea  of  using  CWA  for  developing  task  models  of  covert  networks  has  been 
explored  by  [14.],  but  they  were  less  concerned  with  either  generating  social  networks  from  these  models 
or  with  exploring  the  space  of  possible  network  structures  (preferring  to  consider  Bayesian  models  of  how 
tasks  might  relate  to  available  resources).  The  approach  to  task  modelling  in  this  work  uses  Cognitive 
Work  Analysis  [11.],  and  employs  two  function  decomposition  strategies:  the  Abstraction  Hierarchy, 
which  maps  the  Functions  required  to  achieve  an  objective,  in  terms  of  available  resources,  and  is  used  to 
provide  an  overview  of  the  type  of  Mission  to  be  analysed.  This  would  be  developed  and  elaborated  by 
available  intelligence  and  by  the  Intelligence  Analysts  knowledge  and  experience,  and  Social  and 
Organisational  Analysis  of  Contextual  Activity,  which  allows  the  analyst  to  map  plausible  relationships 
between  Actors  and  Tasks.  Figure  3  shows  possible  functions  in  heroin  trafficking.  Different  Actors  are 
represented  by  different  shading,  functions  are  aligned  to  specific  Situations,  and  the  ‘box-and- whiskers’ 
show  the  possibility  that  Functions  could  occur  in  more  than  one  Situation. 


^\Situations 

Farm  /  Plantation 

Market/  Bazaar 

Refinery 

Border 

Europe 

Functions 

Cultivation  of 
poppy 

Extraction  of 
morphine 

Bulk  sale  of 
‘pure’  heroin 

Preparation  of 
‘street  grade’ 
heroin 

Figure  3:  Contextual  Activity  Template 
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Phase  Three:  Explore  Alternative  Network  Structures:  In  order  to  translate  from  the  Contextual  Activity 
Template  to  a  network  that  links  Actors  together,  we  make  the  assumptions  that  consecutive  Functions 
require  liaison  between  Actors  and  that  Functions  which  involve  more  than  one  Actor  could  require  liaison 
between  these  Actors.  This  allows  an  initial  version  of  a  Social  Network  to  be  constructed.  However,  this 
does  not  provide  any  indication  of  the  number  of  alternative  networks  that  could  be  produced,  and  we 
argue  that  it  is  necessary  for  the  Intelligence  Analyst  to  be  able  to  conceive  of  alternative  networks  in 
order  to  define  intelligence  requirements  and  to  consider  plausible  alternatives.  Thus,  we  explore  the 
biding  of  Actors  to  Functions  through  the  application  of  Genetic  Programming  (GP)  algorithms  [13.]  GPs 
are  typically  represented  in  the  form  of  tree  structures  in  which  the  nodes  represent  particular  operations 
(see  figure  4).  T  program  seeks  efficient  routes  through  the  tree  to  reach  a  given  solution.  In  very  broad 
terms,  one  can  contrast  a  GP  approach  with  Artificial  Intelligence  (AI).  Imagine  one  wishes  to  develop  a 
system  which  Teams’  a  set  of  mles  to  mn  a  maze.  One  approach  in  AI  might  be  to  provide  some  basic 
rules  to  the  system  and  then  expose  it  to  a  number  of  mazes.  The  system  would  apply  the  rules  it  has,  and 
the  programmer  might  provide  feedback  to  the  system  in  terms  of  its  performance.  GP  takes  a  very 
different  approach  in  that  it  does  not  assume  any  combination  of  rules  but  rather  has  components  of  the 
system  which  specific  abilities.  The  components  are  able  to  respond  to  the  maze  and  their  ‘fitness’  is 
assessed,  e.g.,  if  a  component  is  able  to  move  in  the  maze  then  it  survives,  otherwise  it  dies.  Over  a 
number  of  trials,  components  can  evolve,  breed  or  otherwise  develop,  such  that  the  components  which 
survive  early  trials  continue  to  tackle  subsequent  trials.  In  this  way,  the  behaviour  is  not  due  to 
specification  of  rules  but  rather  arises  from  the  mapping  between  component  behaviour  and  environmental 
conditions.  The  evolution  of  these  structures  is  influenced  by  mutation  and  crossover  (both  of  which  can 
be  supported  easily  by  tree  structures).  Crossover  occurs  when  two  parent  nodes  in  the  tree  are  exchanged. 
Mutation  occurs  when  a  parent  node  in  the  tree  is  randomly  selected  and  its  sub-tree  is  replaced  by  a  new 
one.  Crossover  and  mutation  are  applied  separately. 

If  we  assume  that  the  main  problem  to  be  solved  is  the  efficient  utilisation  of  available  Actors  in  order  to 
produce  an  optimal  supply-chain,  then  one  can  imagine  a  set  of  algorithms  that  will  be  relate  the 
availability  of  Actors  (in  terms  of  whether  they  are  currently  performing  a  Function)  and  the  ability  of 
Actors  (in  terms  of  whether  they  can  be  associated  with  the  Function).  From  this,  one  might  assume  that 
some  Actors  will  not  be  available,  with  the  result  being  either  a  delay  or  a  reduction  in  the  probability  of 
success.  An  application  has  been  written  in  MS  Visual  C++  to  run  under  Microsoft  Windows  XP.  The 
model  maps  Actors  to  Function,  using  Genetic  Programming.  In  this  application,  each  mission  is 
represented  as  a  tree  that  can  grow  (through  mutation  or  crossover)  to  a  maximum  size  of  1000  nodes.  As 
the  GP  tree  is  evaluated  it  produces  a  vector  of  real  numbers.  This  vector  is  analysed  and  interpreted  in 
the  context  of  a  "grammar".  In  this  work,  this  grammar  is  defined  by  the  binding  of  Actors  to  Tasks,  e.g., 
"Actor  #:  Number  of  tasks,  task  l...task  x”. 

The  tree  structure  will  be  populated  by  numbers  and  operators.  At  various  points  in  the  tree  structure’s 
iteration  a  ‘write  to  file’  command  is  issued  and  the  product  of  the  tree  is  read  off.  For  example,  the 
following  tree  combines  randomly  generated  numbers  on  its  branches  that  can  be  combined  using 
operators  to  produce  the  number  4.9  (i.e.,  10  -  (5  +  0.1)  =  4.9). 


Figure  4:  Example  Tree  Structure 


15-4 


RTO-MP-MSG-069 


TO 

'AN 


Predicting  the  Structure  of  Covert  Networks  using  Genetic  Programming, 
Cognitive  Work  Analysis  and  Social  Network  Analysis 


In  a  sense,  the  tree  represents  the  genome.  The  phenotype,  in  this  instance,  is  a  string  of  digits  read 
from  the  tree,  e.g., 


4.9 

1.7 

3.2 

1.05 

Figure  5:  Vector  String 

This  string  of  digits  defines  the  vector  of  real  numbers.  Initially,  each  vector  is  examined  from  left  to 
right.  A  novel  aspect  of  our  approach  is  that  each  vector  will  be  examined  in  four  ways  (by  rotating  the 
string  to  produce  four  versions).  Take,  for  example,  figure  5  above  {4.9,  1.7,  3.2,  1.05...}.  For  the  first 
number  in  this  string,  4.9,  we  drop  the  4  and  are  left  with  0.9.  Using  the  range,  0  -  1,  we  bin  this  range 
according  to  the  maximum  number  of  Functions  we  will  assign  to  any  Actor,  such  as  4.  So,  in  this  case, 
the  range  0  -  1  is  divided  into  4,  i.e.,  0.25,  0.5,  0.75,  1.0.  As  0.9  is  greater  than  0.75  but  less  than  1.0  we 
get  to  the  3rd  bin  so  the  Actor  will  be  assigned  3  Functions.  In  order  to  determine  which  Functions  are 
assigned  to  this  Actor,  we  move  to  the  next  number,  1.7.  Again,  we  drop  the  1  to  have  0.7.  Assume  that 
are  20  tasks  in  the  mission.  The  range  0-1.0  is  binned  into  20  chunks.  The  number  0.7  equates  to  class  14. 
So,  that  means  that  Actor  1  can  do  Function  14.  Then  we  look  at  the  next  number,  3.2,  which  we  interpret 
as  Function  4  (because  0.2  falls  on  the  4th  division).  We  repeat  this  with  1.05,  to  get  0.05  (which  equates  to 
task  1).  Thus,  we  interpret  the  vector  to  mean:  {Actor  lis  assigned  3  Functions  which  are:  14,  4,  1}.  This 
represents  an  initial  solution  to  the  binding  problem.  Once  a  sequence  of  tasks  has  been  assigned,  and  a 
mission  defined,  the  GP  generates  a  new  vector.  If  the  vector  has  been  previously  produced,  it  is  not 
analysed.  By  recording  each  novel  string,  the  GP  generates  several  combinations  of  Actors  to  Function 
(given  any  constraints  placed  on  the  Actors)  and  this  combination  is  then  run  in  the  model  (defined  by  the 
Task  model).  The  GBG  software  tool,  developed  to  support  this  activity,  requires  the  following  steps: 

Step  1:  Define  Task  Model:  The  Analyst  can  Add  a  Task  to  the  set  (on  the  left  of  the  screen).  Each 
Task  can  be  linked  to  other  Tasks  because  it  provides  an  Output  to  other  Tasks  (or  receives  Input 
from  them).  In  this  way,  the  Task  Model  can  be  constructed  as  a  sequence  of  dependencies  between 
Tasks.  In  this  work,  we  are  only  building  Task  Models  with  simple,  linear  dependencies.  This  is 
partly  due  to  the  source  material  we  are  using  and  partly  due  to  desire  to  keep  each  element  in  the 
modelling  work  as  simple  as  possible.  However,  there  is  no  reason  why  the  Task  Model  could  not 
include  multiple  dependencies  and  parallel  activity  (but  this  would  be  the  subject  of  subsequent 
research). 

Step  2:  Define  Actors:  The  Analyst  can  Add  Actors  to  the  model.  At  present,  the  Actors  can  either 
be  assigned  Tasks  manually  or  have  Task  assignment  through  the  Genetic  Programming  (see  step 
3d).  Future  work  would  develop  Actor  capabilities  so  that  they  could  be  allocated  to  Tasks  in  terms 
of  their  ability  to  perform  them. 

Step  3:  Build  Task  Model:  Each  Task  can  be  further  defined  in  terms  of  a  Time  (defined  as  a 
Gaussian  distribution)  and  a  timing  model.  The  sequence  of  Tasks,  taken  from  Step  One,  is  shown 
graphically,  and  the  timing  model  is  used  to  determine  whether  the  dependent  Task  will  start  on 
termination  of  the  current  Task  or  at  some  point  during  the  Task.  There  are  three  possible  points 
(beginning,  middle,  end)  of  the  each  task. 
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Figure  6:  Defining  parameters  for  Task  Model 


Step  4:  Run  GP:  The  allocation  of  Tasks  to  Actors  can  be  assigned  by  the  Analyst  through 
selecting  each  Task  (on  the  left)  and  then  selecting  which  Actors  could  perform  the  Task.  This 
results  in  a  grid  (on  the  right)  showing  the  allocation  of  Actors  to  Tasks  (in  blue).  The  Genetic 
Program  will  use  this  information  to  randomly  pick  possible  Actors  for  each  Task  in  the  sequence. 


Figure  7:  Assigning  Tasks  to  Actors 

Step  5:  Explore  Results:  The  GBG  tool  generates  permutations  of  Actors  and  Functions  and  selects 
those  which  result  in  the  mission  being  completed.  These  permutations  can  then  be  visualised  in 
terms  of  the  allocation  of  function  to  actors,  the  timeline  of  the  process,  or  the  communications 
between  actors  (see  figure  8). 
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Figure  8:  Output  Analysis  from  GBG  (resulting  task  model  and  social  network  matrix  for  model) 

The  task  model,  on  the  left,  shows  the  Actors  who  could  be  assigned  a  given  Function  (in  blue) 
and  the  Actors  who  the  GP  solution  actually  assigns  (in  red).  Thus,  the  algorithm  offers 
alternatives,  in  terms  of  who  might  perform  the  Functions,  but  only  selects  one  person  to  do  the 
work.  This  echoes  the  earlier  discussion  of  covert  network  structure. 

Phase  Four:  Compare  and  Analyse  Social  Networks:  The  communication  between  actors,  produced  by 
GBG,  can  be  saved  as  a  .csv  file  (for  wither  specific  instances  or  as  an  amalgamation  of  instances  which 
share  common  features).  In  this  part  of  the  work  we  employed  the  WESTT  tool  developed  under  the  HFI- 
DTC  [10.].  The  .csv  file  is  edited  in  MS  Excel  and  then  saved  as  a  MS  Excel  before  being  imported  into 
WESTT  for  analysis.  As  figure  9  shows,  the  WESTT  tool  produces  a  social  network  diagram  and 
performs  several  analyses  related  to  the  connections  and  distance  between  actors  in  the  network. 
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Figure  9:  Example  of  Social  Network  Analysis  in  WESTT 


2.0  CASE  STUDY:  MARIJUANA  SMUGGLING  NETWORK 

Objective :  compare  networks  generated  from  task  models,  using  gbg,  with  network  compiled  from 
intelligence  (taken  from  [18.]  ). 

Outline:  The  analysis  of  drug  smuggling  rings  in  [18.]  focused  on  the  export  rings  and  the  import  rings. 
The  book  does  not  detail  the  growing  and  processing  of  the  cannabis,  nor  does  it  detail  much  about  the 
distribution  and  sales  after  the  main  wholesaling.  The  main  research  is  concerned  with  the  interaction  of 
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the  export  ring  with  the  import  ring,  and  the  manner  in  which  the  Customs  and  Drug  Enforcement 
Agencies  attempt  to  detect,  infiltrate  and  defeat  these  rings. 

Compile  Intelligence:  Daniels  negotiates  with  farmers  and  landowners  for  the  price  of  cannabis,  and  buys- 
off  the  military,  police  and  narcotics  control.  He  also  puts  investors  and  financiers  together  to  fund 
shipments.  His  deals  could  be  in  the  order  of  20  tons  of  Thai  Sticks  at  a  time.  He  arranges  for  all  of  the 
cannabis  to  be  brought  to  a  central  warehouse  where  it  was  compacted  and  vacuum  packed  to  preserve  it. 
Daniels  also  has  a  system  organised  to  prevent  searching  of  his  crates  containing  cannabis  at  the  port.  He 
has  a  blue  crest  stamped  'passed’  onto  a  tag.  All  crates  with  this  tag  were  not  inspected  by  the  customs 
men,  in  return  for  payment.  By  bribing  the  military,  police  and  narcotics  control  personnel  at  all  levels  he 
received  tip-offs  as  well  as  assistance  in  his  smuggling  operations.  The  Import  Ring  is  the  'Coronado 
Company’  in  table  1.  The  four  main  players  in  the  'Coronado  Company’  are  Villar  (who  handled 
procurement  and  negotiations),  Weber  (who  was  the  pilot  and  mechanic),  Otero  (who  was  the  beach- 
master  and  organised  the  landing  and  offloading  of  cannabis),  and  Acree  (who  was  in  charge  of  sales  and 
distribution).  They  employ  people  to  captain  the  ship  for  bringing  cannabis  into  the  country,  and  also 
employ  an  offload  crew  to  get  the  cannabis  off  the  ship  to  a  safe  stash  house.  The  'Coronado  Company’ 
has  a  communications  house  with  a  high  power  antenna  and  a  ship-to-shore  radio,  so  that  movement  of  the 
coast  guard  could  be  reported  and  the  drop  off  could  be  arranged. 

Create  Task  Model:  The  task  model  begins  with  an  outline  of  actors  and  the  functions  with  which  they  are 
associated.  For  the  purposes  of  this  analysis,  this  information  is  taken  from  a  reading  of  [18.]  and 
presented  in  table  1.  Figure  10  shows  that  there  is  mixture  of  'discrete',  'inter-dependent'  and  'multiple' 
(i.e.,  several  Actors  could  perform  a  specific  Task)  role  allocation  in  the  function-situation  matrix,  and  the 
relationships  between  Actors  is  illustrated  by  figure  11. 


Table  1:  Actors  and  Functions  in  Case  Study  Two 


Agent  Role 

Description 

Farmers 

Grows  marijuana  using  traditional  farming  techniques 

Fandowners 

Own  the  land  on  which  the  farmer  grows  marijuana 

Military 

Mostly  army  in  Thailand,  may  be  used  to  protect  transport  of 
marijuana  to  dockside 

Police 

May  provide  intelligence  of  impending  operations  and  steer 
operations  away  from  Daniels 

Narcotics  officers 

May  provide  intelligence  of  impending  operations  Iso  do  not  search 
cargo  with  'Passed  inspection’  labels  on  them  in  return  for  payment 

Investors 

Putting  up  money  to  finance  shipment  in  return  for  cut  of  the  profits 

Financiers 

People  lending  money  to  the  investors 

Daniels 

Key  link  between  the  Export  ring  and  Import  ring;  specialises  in 
putting  all  the  people  together  and  stays  in  the  background  of  the 
operation,  but  takes  large  profits  for  himself. 

Chris  (captain) 

Experienced  sailor,  hired  on  an  occasional  basis  for  a  large  fee 

Villar  ( procurement ) 

Skilled  negotiator  and  has  multiple  languages.  Understands  about 
the  quality  of  marijuana. 

Weber  ( mechanic ) 

Skilled  mechanic,  looks  after  all  the  equipment 

Otero  (beachmaster) 

Offloading  the  marijuana  from  the  ship  to  the  stash  house. 

Acree  (sales) 

Has  a  wide  sales  and  distribution  network. 

Del  Mar  (distribution) 

One  of  the  distribution  networks. 

Offload  crew 

The  team  that  work  under  Otero. 

Truck  drivers 

Drivers  of  trucks. 

Guards 

People  used  to  guard  the  marijuana  at  various  points  on  its  journey. 
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\7  Military 
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Contextual  Activity  Template 

Figure  10:  Contextual  Activity  Template  for  Case  Study 
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Figure  11:  Social  Network  constructed  from  initial  ‘intelligence’ 

Explore  alternative  network  structures:  It  was  assumed  that  there  would  be  a  degree  of  constraint 
in  the  allocation  of  Tasks  to  Actors.  The  construction  of  the  GBG  model  involved  translating  table  1  into  a 
process  model  and  assigning  Actors  to  Tasks  based  on  figure  12.  This  would  provide  sufficient  constraint 
on  the  binding  between  Actors  and  Tasks  to  reduce  to  number  of  connections.  One  possible  problem  with 
this  approach  is  that  the  Task  Model  we  were  using  is  quite  simplistic  (on  the  basis  of  the  details  provided 
in  the  source  material),  and  one  might  anticipate  a  more  robust  Task  Model  to  be  developed  from 
Intelligence  materials. 


Figure  12:  GBG  model  for  Case  Study  Two 
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Having  created  the  process  model  and  defined  plausible  actors  for  each  task,  the  model  was  run  with  a 
population  of  1000  over  3  runs.  This  produced  16  solutions  for  run  1,  15  solutions  for  run  2,  and  18 
solutions  for  run  3.  Overall,  the  solutions  had  a  range  of  fitness  scores,  as  shown  in  table  2. 

Table  2:  Number  of  Solutions  for  different  Fitness  Score 


Fitness  Score 

Number  of  Solutions 

2.99151 

38 

2.99123 

3 

2.99068 

4 

2.99041 

1 

2.98986 

1 

2.98904 

2 

The  38  solutions  with  maximum  score  we  saved  and  used  to  populate  WESTT  for  subsequent  analysis. 

Compare  and  Analyse  Social  Networks:  Each  network  was  subjected  to  basic  Social  Network 
Analysis,  using  metrics  that  relate  to  the  number  of  connections  for  each  node  and  the  distance  between 
nodes  in  the  network.  The  results  of  this  analysis  are  compared  against  metrics  produced  from  review  of 
[18.]. 


Figure  13:  Examples  of  Social  Networks  derived  from  GBG  Tool 

Figure  10  shows  the  network  that  could  be  derived  from  a  reading  of  [18.].  Broadly,  it  shows  what  looks 
like  a  clique  centred  on  Daniels,  and  another  clique  centred  on  the  Beachmaster.  One  possible  explanation 
of  the  structure  of  the  network  shown  in  figure  19  is  the  desire  to  maintain  separation  between  Actors 
other  than  the  key  Actors.  Thus,  the  'production’  Actors  (in  the  top  right  of  the  figure)  have  no  connection 
with  the  'distribution’  Actors  (in  the  top  left  of  the  figure).  Another  explanation  might  simply  be  that  the 
source  material  was  focussing  primarily  on  the  role  of  Daniels  (the  'Boss’)  and  the  Coranado  Company 
(involving  named  individuals  in  an  import  ring).  Both  Daniels  and  the  Beachmaster  were  identified  in 
table  1  as  being  key  players  in  this  network  (the  other  key  players  being  Mechanic  and  Procurement). 
Figure  10  contains  more  actors  than  each  of  the  networks  shown  in  figure  13.  This  can  be  explained 
simply  by  virtue  of  the  fact  that  the  networks  produced  in  figure  13  were  developed  to  perform  the 
specified  tasks  and  had  a  limit  on  the  number  of  actors  who  could  perform  a  task,  whereas  figure  10  does 
not  represent  the  performance  of  a  specific  task  so  much  as  the  summation  of  all  contacts  mentioned  in  the 
book.  While  we  have  assumed  a  network  structure  that  links  Actors  on  the  basis  of  Functions,  this 
produces  small  networks  with  little  redundancy.  If  we  follow  the  description  of  'structural  holes’  put 
forward  by  [3.],  then  we  might  assume  that  there  are  information  and  resilience  benefits  to  be  gained  from 
larger  networks  with  many  non-redundant  contacts. 
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Clustering  Coefficients:  A  series  of  routines,  using  PySNA  a  Social  Network  Analysis  library  in  Python1, 
was  used  to  read  the  output  files  generated  by  the  GBG  tool,  in  order  to  construct  models,  calculate 
clustering  coefficients  and  perform  simple  resilience  analysis  (figure  14). 


Clustering  Coefficient 


Network  identification  numbers 


Figure  1410:  Graph  showing  networks  by  clustering  coefficient 

Figure  14  shows  the  results  of  the  analysis.  One  can  see  that  the  network  model  from  the  source  material 
lies  towards  the  right  hand  side  of  the  figure,  and  that  the  GBG  model  produces  many  networks  with  much 
lower  clustering  coefficients.  In  part  this  is  because  the  Task  Model  we  have  used  implies  a  linear  chain 
of  activity  which  could  require  limited  connection  between  Actors.  A  more  detailed  Task  Model,  in  which 
Tasks  are  either  performed  in  parallel  or  in  which  there  are  ‘dummy’  Tasks  could  lead  to  a  more  highly 
connected  network.  However,  it  is  worth  noting  that  an  aim  of  the  covert  network  must  be  to  maintain 
sufficient  connectivity  to  operate  with  minimal  connection  of  critical  Actors  and  maximal  separation  of 
key  Tasks. 

Testing  Resilience:  In  addition  to  considering  clustering,  the  PySNA  tool  allowed  the  exploration  of 
resilience.  In  this  analysis  we  simply  removed  Actors  one  at  a  time  from  the  network  to  explore  the 
impact  on  the  number  of  links.  Figure  16  illustrates  the  impact  of  removing  Actors  from  the  Network 
developed  from  the  source  material.  One  can  see  that  removing  the  key  Actors  (using  SNA  metrics  from 
the  highest  to  lowest  score)  has  a  dramatic  a  rapid  destruction  of  the  network  (the  pink  line  in  figure  15). 
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Figure  15:  Removing  Key  and  Peripheral  Actors  from  the  source  material  Network 


This  is  to  be  expected  because  the  highly  connected  Actors  hold  the  network  together  and  their  removal 
leads  to  rapid  destruction,  i.e.,  removing  ‘Daniels’  splits  the  network  into  two  separate  regions  and 
removes  a  bunch  of  Actors  who  only  connect  to  this  Actor. Removing  Actors  from  the  periphery  (i.e.,  with 
low  SNA  scores)  has  limited  impact  and  implies  that  the  network  could  continue  functioning  with  the 
removal  of  some  dozen  or  so  Actors  before  problems  occur.  The  point  of  interest  is  that  such  ‘targeted 
destruction’  of  the  network  relies  on  both  the  opportunity  to  attack  the  network  and  the  identification  of 
high  status  nodes.  It  also  implies,  perhaps,  that  all  networks  can  be  attacked  in  a  similar  manner  but  this  is 
not  the  case.  Some  networks  might  require  targeted  destruction  whereas  others  could  be  dealt  with  through 
random  attack.  Applying  this  resilience  analysis  to  all  of  the  networks  produced  by  the  GBG  model,  we 
see  varying  effects  of  targeted  and  random  attacks.  This  is  illustrated  by  graphs  in  figure  16.  The  blue  and 
pink  lines  represent  ascending  and  descending  SNA  scores  (as  in  figure  16)  and  the  other  lines  represent  3 
different  random  attacks,  i.e.,  removing  Actors  irrespective  of  their  scores.  For  the  Low  Clustering 
Coefficient,  it  seems  as  if  there  is  little  to  choose  between  the  various  approaches  and  that  all  attacks  result 
in  a  similar,  linear  degradation  with  the  number  of  nodes  removed.  This  means  that  for  around  12  or  so 
networks  produced  by  the  GBG  tool,  a  random  attack  would  be  sufficient  to  disrupt  them.  For  the 
Medium  and  High  Clustering  Coefficient  Networks,  the  picture  is  a  little  more  complicated.  Some  random 
attacks  would  result  in  similar  performance  to  the  removal  of  high  status  nodes,  others  would  be  slightly 
less  effective.  However,  the  random  attacks  tend  to  lead  to  faster  disruption  than  the  removal  of  the  low 
status  nodes.  This  implies  that  it  might  be  possible  to  disrupt  such  networks  without  high  investment  in 
intelligence  gathering. 


Figure  116:  Comparison  of  Targeted  and  Random  Attack  on  Networks  with  Different  Clustering  Coefficients 
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Both  sets  of  networks  suggest  that  removal  of  the  high  status  nodes  while  obviously  leading  to  rapid 
disruption  to  the  network  might  not  be  key  to  attacking  the  networks  produced  by  the  GBG  model.  Of 
course,  there  is  a  strong  caveat  to  be  made  here:  the  GBG  model  is  only  as  good  as  the  Task  Model  that 
informs  it.  This  points  to  further  work  which  would  involve  the  analyst  in  conducting  ‘what-if 
assessments  of  different  network  types  in  order  to  further  explore  assumptions  of  how  the  network  might 
function  and  how  it  might  be  disrupted.  Thus,  is  possible  to  evolve  social  networks  on  the  basis  of 
function-actor  mappings  and  to  provide  opportunities  for  exploring  disruption.  Current  work  is  exploring 
situations  in  which  tasks  can  be  allocated  to  several  individuals  on  the  basis  of  the  knowledge,  skill  and 
ability,  such  that  loss  of  individuals  need  not  compromise  the  network.  Initial  explorations  suggest  that,  as 
one  might  expect  from  scale-free  networks,  only  a  few  nodes  represent  significant  losses  to  the  network 
and  many  other  nodes  can  be  lost  with  little  cost. 
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